New MySQL file system vulnerabilities

Posted in: MySQL

It’s been a busy month for file vulnerabilities. Thanks to Dawid Golunski at legalhackers.com for giving us all the opportunity to tighten security in our MySQL, MariaDB, and Percona Server instances.

Note that 6664 is dependent on 6663, and 6663 can be mitigated by turning off symbolic_links (=0). Upgrade to the latest versions also fixes the problem. Regardless, the attacker needs to have access to the box.

You can mitigate this issue by setting symbolic_links=0, but we recommend upgrading to permanently fix the issue. If you are using symbolic_links in your environment, your only solution is to upgrade. Oracle MySQL, MariaDB, and Percona Server have each patched this in their latest versions. As always, ensure that your database servers are not accessible outside your network.

 

email
Want to talk with an expert? Schedule a call with our team to get the conversation started.

About the Author

Internal Principal Consultant
With experience as an open-source DBA and developer for software-as-a-service environments, Valerie has expertise in web-scale data storage and data delivery, including MySQL, Cassandra, Postgres, and MongoDB.

1 Comment. Leave new

Hi Valerie, could you recommend a particular course or certificate that i could do to get a deeper understanding of MySQL maybe it could become a blog post? i have some experience creating databases, tables ect mostly self learned. So i guess i would be at junior level.

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *